IP & Subnet Calculator

This calculator takes any IPv4 address and a CIDR prefix (or subnet mask) and derives every value you need to describe that network: the network address, broadcast address, the first and last usable host, the total number of addresses in the block, and how many of those are actually assignable to hosts.

Subnetting decisions show up constantly in security work: scoping a vulnerability scan to a specific range, writing firewall rules that match an exact network, sizing a segment for micro-segmentation, or quickly checking whether an IP seen in a log falls inside a trusted internal range. Doing this math by hand is slow and error-prone, especially under time pressure during an incident.

The tool converts the IPv4 address and mask into 32-bit integers, applies bitwise AND/OR/NOT operations to derive the network, broadcast and wildcard values, then converts the results back into dotted-decimal form. It also checks the address against well-known private, loopback, link-local and multicast ranges to classify it.

1. 1Enter an IPv4 address, optionally with /CIDR appended (e.g. 10.0.5.10/24).
2. 2If you didn't include a CIDR suffix, enter the prefix length or a dotted subnet mask in the second field.
3. 3Review the network, broadcast, usable range and host counts generated instantly.
4. 4Copy the summary to paste into documentation, tickets or firewall rule notes.

192.168.10.42/26 -- a /26 splits a /24 into four blocks of 64 addresses each. This host falls in network 192.168.10.0, with usable hosts 192.168.10.1 through 192.168.10.62 and broadcast 192.168.10.63.

10.0.0.0/8 -- a huge private range (RFC 1918) commonly used as an internal corporate address space, with over 16 million total addresses.

203.0.113.5/31 -- a point-to-point link. /31 has no network or broadcast address; both addresses in the pair are usable, per RFC 3021.

• Forgetting that /31 and /32 don't follow the usual 'subtract 2 for network and broadcast' rule.
• Confusing the subnet mask with the wildcard mask when writing ACLs (many firewall syntaxes want the wildcard, i.e. the mask's bitwise complement).
• Assuming a private IP is automatically 'safe' -- private ranges can still be misconfigured, exposed via NAT, or the source of internal lateral movement.
• Mixing up prefix length with the actual number of usable hosts, especially for very small subnets like /30.

Subnet calculations are informational and don't validate whether a range is actually reachable, allocated, or in active use. When scoping scans or firewall changes, always cross-check calculated ranges against your organization's IPAM records before acting on them, and be cautious about scanning ranges you don't own or have authorization to test.